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INTRODUCTION and BACKGROUND 

1. The present Report of Findings is made pursuant to subsection 60(1) of the Right to 
Information and Protection of Privacy Act, S.N.B. c. R-10.6 ("the>4ct"). 

2. On May 9, 2013, the Department of Education and Early Childhood Development ("the 
Department") reported a privacy breach to the Commissioner, asking that the 
Commissioner investigate the matter. 

3. Subsequently, the family of the student at the heart of the privacy breach matter filed a 
privacy concern with our Office on May 13, 2013 involving the Minister, the Minister's 
Office, and the Department. The family stated that the student's personal information 
was shared between the Department and the Minister's Office without the family's 
consent and that the student's personal information was read aloud to unknown 
recipients, including a fellow student who overheard and shared the information with 
the student in question. The family also indicated that they had additional concerns 
about how much of the student's personal information was shared, why and with whom. 

4. This matter stems from the handling of personal information of a student in relation to a 
specific graduation requirement in the Anglophone Sector of the New Brunswick public 
school system, namely a test known as the English Language Proficiency Assessment 
("the Assessment"). The Anglophone Sector has different graduation requirements than 
the Francophone Sector, and requires students to successfully complete the Assessment. 
The Assessment is usually written in Grade 9, and where students do not pass the 
Assessment at this point, they are given the opportunity to rewrite in Grade 11 and again 
in Grade 12, if necessary. 

5. The family arrived in New Brunswick after having lived outside of Canada for some time, 
and the student began Grade 12 in September 2012. Based on the fact that they had 
moved from an English-speaking country where the student had been enrolled in the 
public school system, the family questioned whether it was necessary for the student to 
write the Assessment. The family felt that the student's academic record demonstrated 
a high level of proficiency in English and did not want the student to undergo the 
additional stress of writing the Assessment during the graduation year if it was not 
absolutely necessary. 

6. The family felt strongly about this issue and asked for assistance from various sources, 
and in doing so, discussed their situation at various times with the school, the 
Department, the Minister, Members of the Official Opposition, and the media. The 
details of this matter were widely reported in the media at the time. 
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7. Students normally write the Assessment during the January examination period, but for a 
number of reasons that will be discussed in greater detail below, the student in this case 
wrote the Assessment in April 2013. 

8. The Department followed its established practice for scoring the student's Assessment 
and reporting the student's Assessment results through the appropriate channels. 

9. More than one privacy breach arose when some information about the student's 
Assessment was accessed and shared outside of the established practice and with 
individuals who were not authorized to know this information. On May 1, 2013, a 
Department staff member noted the student's Assessment results and sent an email to 
senior staff at the Department containing the student's name, the fact that the student 
had passed the Assessment, and the student's results. It was highly unusual that a 
student's individual Assessment results would be shared with senior staff. 

10. Further, a senior official with the Department forwarded this email on to the Minister's 
Executive Assistant, who read the email aloud at home and was overheard by a family 
member in another room. The family member knew the student, as they were friends at 
school, and sent a text message to congratulate the student on passing the Assessment. 
The student and the student's family had not yet been notified of the results through the 
established protocol with the school. 

11. This Report will address the circumstances that lead to these occurrences, including how 
the Assessment is normally administered by the Department, what happened to cause 
the privacy breaches and the reasons why they took place in this case. The Report will 
also provide recommendations to conclude our work in this matter. 

COMMISSIONER'S INVESTIGATION 

12. The Commissioner serves as an independent oversight body for public bodies in relation 
to their obligations under the Act, including the protection of privacy. As such, the 
Commissioner's Office can receive breach notifications from public bodies as well as 
concerns surrounding privacy from members of the public in regards to the handling of 
their personal information by public bodies. 

13. The Commissioner's role in relation to all privacy matters is to conduct an independent 
and impartial investigation to determine whether the public body involved appropriately 
handled personal information in accordance with its obligations and the rules set out in 
Part 3 of the Act. 
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14. In this case, our Office investigated the self-reported breach and the family's privacy 
concern together, allowing us to gather all of the relevant facts and information in 
relation to both at the same time. As with all investigations into privacy matters, our 
primary objective was to uncover all of the relevant facts and details to understand the 
context in which the situation arose, to determine what happened and the events that 
led up to and including the breach, the causes of the breach, and the steps taken by 
those involved once the breach became known. 

15. We interviewed several officials from the Department, as well as the Minister's Executive 
Assistant, the Minister himself, and family members of those involved in the matter. We 
note that this case was in the public eye throughout our investigation as the facts, on- 
going issues, and updates were constantly being reported in the media and discussed in 
the public proceedings of the Legislative Assembly. Despite this public pressure and 
heightened sensitivity in participating in an investigation under these circumstances, we 
received good cooperation from all, and we were pleased with the level of openness and 
candour shown by those involved in our investigation. 

16. We also extensively reviewed the Education Act, the applicable Departmental policies 
and procedures, and documentation provided on the specific graduation requirements in 
the New Brunswick public school system, including the Assessment. We also examined 
other documentation provided by those who were interviewed as part of our 
investigation. 

17. The Commissioner's investigations are confidential. We informed all those that we 
interviewed to remain mindful of this fact, despite the ongoing public and media interest 
in the case throughout the course of our investigation. Now that we have concluded our 
investigation, we are able to publicly report our findings. 

18. It must be understood that the Commissioner's investigation is to uncover the truth of 
what happened, to focus on facts in order to arrive at findings and to identify any errors 
that were committed when handling personal information with a view to correct them so 
that they are not repeated in the future. In short, we are looking to engage public bodies 
in achieving compliance with the law rather than assign blame. 

Facts Uncovered 

19. This case centered in large part on the family's concern about the student having to write 
the Assessment as a graduation requirement. It is essential that for the purposes of this 
Report that we explain in a certain level of detail the Department's administration of the 
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Assessment and how it applied to the student in this case, given that this is the context in 
which the breach arose. 

English Language Prof iciency Assessment 

20. Graduation requirements for students in the New Brunswick public school system are set 
by the Minister of the Department through policy established under the authority of the 
Education Act. 

21. Policy 316, "Graduation Requirements," applies to all students in the New Brunswick 
public school system, and graduation requirements differ between the Anglophone and 
francophone sectors. 1 The requirements for students enrolled in the Anglophone sector 
are established under Appendix A, entitled "Graduation Requirements for a High School 
Diploma" and include the following: 

In the 20-credit system, students must 

• acquire a literacy credential by achieving a successful rating on the reading and 
writing components of the English Language Proficiency Assessment in grade 9. 
A reassessment in grades 10, 11, and 12 is available to students who have not 
achieved a successful rating on the reading and/or writing components; a 
potential graduate reassessment in June of grade 12 is a final opportunity to 
achieve the literacy credential for graduation requirements... 

In the 16-credit system, students must 

• acquire a literacy credential by achieving a successful rating on the English Language 
Proficiency Assessment, or Reassessment in grade 10, 11 or 12... 

Graduation requirements for a student identified as being exceptional (as defined by the 
Education Act) may vary as documented in his/her Special Education Plan (SEP). 
Accommodation (ACC), modification (MOD), and/or individualization (IND) must be 
indicated on the transcript. 

22. Therefore, in order to graduate in the Anglophone sector of the New Brunswick public 
school system, students are required to demonstrate their English language proficiency 
by successfully completing both the reading and writing components of the Assessment. 



1 This Policy is available online on the Department's website at: http://www.gnb. ca/0000/pol/e/3 16A.pdf . 
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23. The general parameters of the Assessment are set out in the policy document entitled 
"2012-2013 Test Specifications: English Language Proficiency Assessment/English 
Language Proficiency Reassessment" 2 as follows: 

Overview 

The English Language Proficiency Assessment/Reassessment (ELPA/R) is an assessment 
of students' literacy abilities based on the Atlantic Canada English Language Arts 
Curriculum Outcomes (grade 8) and the New Brunswick Provincial Achievement 
Standards in Reading and Writing (grade 8). This aligns with the Organization for 
Economic Co-operation and Development (OECD) definition of functional literacy. Data 
obtained from the ELPA/R provide information about individual student achievement 
and provide a perspective on trends in school, district and provincial achievement in 
literacy. 

ELPA 

The English Language Proficiency Assessment (ELPA) is comprised of a Reading 
Comprehension Component and a Writing Component. It is written by all students in 
grade 9 and is a Graduation requirement unless an exemption is sought. Both 
components are scored separately and students must obtain a minimum score of 
Appropriate Achievement (AA) in both components in order to meet the requirement. 
The ELPA is administered during the January examination period. 

ELPR 

The English Language Proficiency Reassessment (ELPR), which is identical to the ELPA, is 
written by students in grades 11 or 12 who have previously scored Below Appropriate 
Achievement (BAA) in on or both components of the ELPA or ELPR unless an exemption 
is sought. Students rewrite only those components in which they have not obtained a 
score of AA. The ELPR is administered during the January examination period. 

Cases in which students have previously obtained a literacy credential on a high school 
provincial literacy assessment from another province will be considered. The 
appropriate documentation must be forwarded to the Assessment and Evaluation 
Branch for approval. Literacy credentials from outside Canada will not be considered. 

24. As set out above, the Assessment is usually written for the first time by students in Grade 
9 during the January examination period. Department officials indicated that Grade 10 is 



2 This document is available on the Department's website at: http://www.gnb.ca/0000/publications/eval/ELPA-R- 
Test-Specifications-2012-2013.pdf . 
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used as an intervention year for students who are not successful on either or both 
components of the Assessment and have the opportunity to rewrite the Assessment in 
Grade 11 and Grade 12, if necessary. Again, this is usually scheduled during the January 
examination period. Department officials indicated that the policy was structured in this 
way to allow ample opportunity for students to prepare for and meet this requirement. 

25. Based on the information provided to us, the policy documents do not specifically 
address the Assessment process for students who transfer into the New Brunswick public 
school system after Grade 9. 

26. This graduation requirement applies to all students enrolled in the Anglophone Sector, 
unless the student qualifies for an exemption or a waiver, which are only granted by the 
Department in certain circumstances. 

Exemption from writing the Assessment 

27. The policy documents show that certain students may be approved for an exemption 
from writing the Assessment, meaning that a student may be excused from writing the 
Assessment either on a temporary or permanent basis. 

28. In order to qualify for an exemption, a student must be following a Special Education 
Plan as provided in the Notes to Appendix A mentioned above: 

Schools may apply to have a student exempted from the Literacy Credential if the 
student is following a modified or individualized Special Education Plan in the 
English language arts area. 

Schools should indicate the required accommodations on the reading or writing 
components for students whose SEP is for accommodations only; these students 
are expected to participate in the assessment. 

29. This means that only certain students who are following a Special Education Plan will be 
approved for a permanent exemption from writing the Assessment. There are no other 
circumstances under which the Department has the authority to authorize a permanent 
exemption. 

Waiver of the Assessment 

30. The purpose of a waiver of the Assessment is quite different from that of an exemption. 
While an exemption is reflective of whether it would be appropriate for a student to 
write the Assessment, the granting of a waiver signifies that the student has already 
successfully obtained a similar literacy credential from another Canadian jurisdiction. 
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31. To qualify for a waiver, meaning that the Department waives the writing of the 
Assessment as a graduation requirement, a student must provide documentation that 
shows that the student has successfully passed a similar literacy credential in Canada. 
The terms in which a waiver is available is found in the policy document, "English 
Language Proficiency Assessment/Reassessment: Final Policy Document" 3 : 

WAIVING OF ELPA/R 

If students have documentation from another province of successful completion of a 
high school literacy credential— these will be accepted. 

This policy applies only to other provinces in Canada. Outside of Canada will not be 
accepted and the students must write the ELPA/R. 

32. The Department informed us that it has reviewed similar literacy assessments 
implemented in other Canadian jurisdictions and deemed some of these to be sufficiently 
comparable to the literacy standards set by the New Brunswick Assessment. 

33. The Department indicated that it made the decision to only accept comparable 
credentials from within Canada, given that the comparative review is a detailed and 
involved process that would require an in-depth consideration of the different curriculum 
and assessment methods in other jurisdictions. As a result, the Department decided as a 
matter of policy not to consider any literacy credentials from outside of Canada, meaning 
that students who enter the public school system from outside Canada will have to 
successfully complete the Assessment to qualify for graduation, unless they fall within 
the parameters of an exemption as described above. 

Administration of the Assessment and Reporting of Results 

34. The Department has established standardized practices for administering the 
Assessment, including the distribution and writing of the Assessment, the scoring 
process, and the compilation and communication of student results. 

35. To begin the process, the Department first distributes the testing materials to the schools 
with students who need to write or rewrite the Assessment. 

36. The Assessment booklets that are distributed to students during the testing process are 
individually labeled for each student with the student's name, grade level, name of his or 
her school, and an assigned identification number with a corresponding bar code that 



3 This document is available online on the Department's website at: 
http://www.gnb.ca/0000/publications/eval/ELPA-RPolicyDocument.pdf . 
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allow the Department to track a student's Assessment without having to use any more 
personal information than necessary. 

37. School officials administer the Assessment on-site for their respective students. Each 
school then gathers all of the completed Assessments and sends them directly to the 
Department. 

38. The Department stores the completed Assessments in a secure location and employs 
confidential services to individually score the tests at a designated secure site. The 
Assessments are returned to the Department after they have been scored. 

39. Once it receives the scores for both the reading and writing components of the 
Assessment, the Department then inputs this information for each student in Grade 9 
who has completed the Assessment, as well as for students in Grades 11 and 12 who 
were required to rewrite the Assessment, into its internal statistical database. If the 
Department finds any inconsistencies or incomplete portions of the Assessment, it is able 
to track these issues using the assigned identifier. 

40. Assessment results are reported as follows: 

o The Department sends individual results to the Superintendent and Director 
of Education for each district. 

o The Department sends individual results to each school principal, which are 
organized by grade and teacher. 

o The school principal shares individual results with each student's teachers, 
and provides the student and parents and/or guardians with a report of the 
student's performance on the Assessment. 

o The student and his/her parent(s)/guardian(s) will receive a personalized 
and confidential report of performance. A label will also be placed in the 
student's cumulative school record with a notation indicating a successful or 
unsuccessful achievement on the English Language Proficiency Assessment. 

41. The Department also uses the compiled score data as it has an interest in identifying and 
tracking general trends and overall success rates, but does not otherwise use or track 
individual results. 
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In the present case 

42. In this case, the student's family arrived in New Brunswick after having lived outside of 
Canada for some time. The student was enrolled in Grade 12 for the 2012/2013 school 
year. At the beginning of the school year, the student was informed that the Assessment 
was a graduation requirement and that the student would have to successfully complete 
it to be eligible to graduate in June 2013. 

43. The family had concerns about this testing requirement and questioned whether it was 
necessary, given the student's previous academic record in the public school system in an 
English-speaking country outside of Canada. 

44. The family contacted the Department in September 2012 with questions about the 
Assessment requirement with a view to determine whether an exception could be made 
for the student under these circumstances. 

45. Staff of the Department informed the family that successful completion of the 
Assessment was a graduation requirement for all students in the Anglophone sector of 
the New Brunswick public school system as established by ministerial policy (Policy 316— 
Graduation Requirements). 

46. The family inquired whether it would be possible for the student to obtain a waiver, as 
they had heard that this may be a possibility. Department staff explained that the waiver 
process was only available for students who transferred to New Brunswick from another 
Canadian jurisdiction and could demonstrate that the student had successfully 
completed a similar literacy credential. The policy was based on the Department's 
previous work to review and approve English language literacy assessments from other 
Canadian jurisdictions as comparable to the standards set by the Assessment. 

47. Where the family had moved to New Brunswick from outside of Canada, it was not 
possible for the student to obtain a waiver. As this was the case, the student would be 
scheduled to write the Assessment during the January examination period. 

48. The family understood that the criteria was set by Departmental policy and indicated to 
Department staff that they intended to raise the issue further as they did not agree with 
the policy. 

49. Shortly thereafter, the family discussed their concerns with a Member of the Official 
Opposition of the Legislative Assembly (the "MLA"), who in turn suggested that the 
family bring its concerns to the Minister's attention to determine if the Minister could be 
of assistance. 
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50. The family consented to having the MLA contact the Minister on its behalf in relation to 
these concerns. In October 2012, the Minister agreed to meet with the family to discuss 
these concerns at the Minister's constituency office in Oromocto. The meeting was set 
up by the Minister's constituency assistant but the Minister met the family on his own. 

51. The Minister recognized that he was acting in both his capacity as Minister of the 
Department and as a Member of the Legislative Assembly. 

52. During the meeting, the family explained its concerns and provided the Minister with 
copies of the student's English language assessment results from the other jurisdiction 
from which the family had moved. The family believed that those results would support 
the fact that the student had demonstrated a high level of English language proficiency 
and thus should not have to write the Assessment. The Minister was sympathetic to the 
family's concerns and wanted to look into the matter further; therefore, the Minister 
accepted the documentation and undertook to look into whether the Policy allowed for 
any discretion to waive or exempt the student from the Assessment requirement. 

53. The Minister followed up with the Department about the Policy and the exemption and 
waiver requirements; both the Department and the Minister agreed that the Policy was 
unambiguous and that the Minister had no discretion to intervene or excuse the 
requirement on a case-by-case basis. The Minister informed the family accordingly at the 
end of October 2012, and indicated that Department staff had assured him that 
accommodations would be made for the student in writing the Assessment so as not 
interfere with other exams and not to write with Grade 9 students. From our 
investigation, the family believed that this meant that the student would write the 
Assessment outside the January examination period. 

54. At the conclusion of these conversations, the family, the Department, and the Minister 
were in agreement that the student had to write the Assessment and that the 
accommodations requested by the family would be put in place. 

55. In early January 2013, one of the student's teachers informed the student that the 
writing time for the Assessment would be taking place during the January examination 
period. The family was upset by this news and again wrote to the Minister, expressing 
frustration about the fact that the student would have to write the Assessment, and that 
the Assessment had been scheduled during the student's exam period. The family 
believed this was contrary to the accommodations the Minister and the Department had 
agreed to provide. 

56. The Minister tasked his constituency assistant to follow up on what appeared to be a 
miscommunication in the accommodations. The constituency assistant reported back to 
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the family that the student was not scheduled to write the Assessment with the Grade 9 
students, but with the Grade 11 and 12 students who would be rewriting the 
Assessment. The constituency assistant also indicated that the school principal would be 
happy to speak with the family at any time. 

57. The family was not satisfied with this response and informed the Minister's constituency 
assistant of the family's decision that the student would not be writing the Assessment. 

58. The constituency assistant passed this information along to senior staff at the 
Department and asked that Department staff contact the school to sort out the situation 
with the family. 

59. As it turned out, the student did not write the Assessment on the scheduled date during 
the January examination period. 

60. Meanwhile, the family spoke to another Member of the Official Opposition regarding this 
whole matter, the then critic for the Education portfolio. After those discussions, the 
family consented for the Member to follow up with the Minister on its behalf about the 
case. The family also turned to the media to go public with these concerns. 

61. At this point, Department staff became concerned that the family's refusal to have the 
student write the Assessment would jeopardize the student's eligibility to graduate in 
June. 

62. Department staff decided to contact the family shortly after the time the student was to 
write the Assessment to discuss possible solutions for this situation. 

63. The Department offered the family two options: a new time for the student to write the 
Assessment in February or an exemption based on the family's refusal to have the 
student write the Assessment. The Department offered the exemption as there was a 
precedent to do so based on the family's refusal to have the student write the 
Assessment, rather than on the exemption criteria as set out in the policy documents, 
which, as explained above, would only be available for students on a Special Education 
Plan. The family opted for the exemption. 

64. The Department has the authority to authorize exemptions in accordance with the 
criteria set out in the policy documents, and the Minister would not be involved in this 
process. 

65. Before the Department was able to prepare the paperwork to send to the family for the 
exemption, the Minister learned of this development as a result of a media inquiry about 
the student's situation. The Minister questioned Department staff about how an 
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exemption could be offered to the family when it was his understanding the Policy was 
clear that the student was ineligible. 

66. As a result of the Minister's inquiries, Department staff looked into the matter further 
and sought advice about whether the exemption offer based on the family's refusal was 
in keeping with the established policy. It was determined that the Policy did not allow 
for an exemption or a waiver in the circumstances presented in this case. In fact, when 
Department staff looked further into the matter, they discovered that the previous 
exemption that had been granted based on the family's refusal to write was under a 
different set of circumstances and the assessment in that case was not a graduation 
requirement. 

67. Consequently, in March 2013, Department staff contacted the family to explain the 
situation and to determine the next steps in order to ensure that the student would 
graduate in June 2013. 

68. The family was quite frustrated at this point, but understood that the Policy remained in 
effect and that the student would indeed have to write the Assessment in order to 
graduate. 

69. The family shared its concerns once again with the Education Critic for the Official 
Opposition and with the media. 

70. During this time, the Department and the school continued to work with the family to 
ensure that appropriate accommodations were in place and the student finally wrote the 
Assessment in April 2013. 

71. Given the public profile of the case, senior Department staff informed the Minister and 
his Executive Assistant (formerly the Minister's constituency assistant, who moved to this 
new position in February 2013) that they had worked with the school and the family in 
making appropriate accommodations for the student to write the Assessment, that the 
family was pleased with this outcome, and that the student was scheduled to write the 
Assessment the following week. 

72. On the first day of the scheduled writing time, the school informed a senior staff member 
with the Department that the student began writing the Assessment. The senior staff 
member informed three other people of this fact by email: another senior staff member, 
the Minister, and the Executive Assistant. 
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73. In late April 2013, the student's completed Assessment materials were scored according 
to the Department's established practice, along with the other students in Grade 11 and 
Grade 12 who rewrote the Assessment. 

74. The staff member prepared the results for the schools as per the established practice. 

75. In compiling the students' results to be issued to the appropriate schools, a staff member 
of the Department authorized to have access to this information specifically noted that 
the student had completed the Assessment and was successful as per the scores the 
student received on each component. This occurred on May 1, 2013, and that same day 
the staff member also sent an email to senior Department staff advising that the scores 
were finalized and that the student was successful on both components. In that email, 
the staff member indicated the scores the student had received on each component. A 
senior Department official forwarded this email on to the Minister's Executive Assistant. 

76. The Minister's Executive Assistant checked his work emails from home that evening and 
read aloud the email containing the student's information. The Executive Assistant was 
not aware that a family member was nearby and overheard the information. The family 
member knew the student because they were friends at school and immediately sent a 
congratulatory text message to the student. 

77. The student responded, asking the family member how this was possible as the student 
had not yet been informed of the results. The family member had "heard [the Executive 
Assistant] reading an email about it," and told the student to "keep this to yourself..." 

78. Later that evening, the student shared the text message exchange with the family, which 
alerted them to the fact that the student's test results had been shared with the 
Minister's Office before the family learned of them through the usual reporting process. 

79. On May 6, 2013, the family discussed this situation with the MLA who had assisted the 
family at the beginning of this case and the family provided copies of the text message 
exchange between the student and the Executive Assistant's family member. 

80. On May 7, 2013, the Official Opposition questioned the Minister during Question Period 
in the Legislative Assembly (which is a public broadcast) about the disclosure of the 
student's test results from the Minister's Office, naming the student in the process. It 
does not appear that the Minister was aware of the situation at this point and the 
Executive Assistant was not aware of the family member's text message to the student in 
question. 
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81. During Question Period on May 8, 2013, the Official Opposition read the text message 
exchange between the Executive Assistant's family member and the student, at which 
point the Minister was able to understand what had taken place. Also on this day, the 
Executive Assistant learned of the events involving the family member, i.e., that the 
email had been overheard and a text sent to the student in question. The Executive 
Assistant immediately briefed the Minister about the events that had transpired. 

82. On May 9, 2013, the Department notified our Office of the situation and asked us to 
investigate. On that same day, the Minister also acknowledged in the Legislative 
Assembly during Question Period that a breach of personal information had occurred at 
the Department and the Minister's Office and that the situation had been reported to 
the Commissioner. That same week, the family contacted the media to share details of 
this situation and to advise that they would be filing a complaint with our Office, which 
the family did on May 13, 2013. 

83. Over the course of the next several weeks, Members of the Official Opposition asked the 
Minister during Question Period to provide further details about the privacy breach 
incident and this case continued to be widely reported in the media. The Minister 
refused to speak about the case or to divulge any personal information in relation to the 
family and the student to prevent any further breaches. We speak more on this later in 
this Report. 

QUESTIONS RAISED IN THIS CASE 

84. Having well established all of the pertinent facts in relation to this matter, we are able to 
provide answers to the essential questions it raises: What happened in this case, and why 
did it happen? 

What happened in this case? 

85. To answer this first question, i.e., what happened in this case, we first need to describe 
what constitutes "personal information" within the meaning of the Act and set out the 
rules under the Act about how personal information should be collected, used and 
shared in all instances by public bodies. We then apply this definition and these rules to 
the facts in order to determine whether the present circumstances amounted to a 
privacy breach. 

86. If we find that a privacy breach did in fact take place, it is essential we delve further into 
the root causes of the breach, i.e., why did the breach happen in the first place. Only 
where we uncover the reasons why a breach occurred are we able to give 
recommendations that ought to prevent a similar breach from happening again. 
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Definition of "personal information" 

87. To understand what "personal information" means, we look to the Act's definition, which 
is broad and includes recorded information that identifies a specific person. The 
information concerns a person and the context within which it is found allows whoever 
knows the information to link it to a specific individual. In other words, it is possible to 
figure out to whom the information relates. 

88. The definition provides specific examples of what is meant by "personal information" but 
the definition is not limited to those specifics. Examples of these specifics include name 
and contact information, age, gender, family status, ancestry, religious beliefs, 
associations, blood type, financial circumstances, criminal history, employment history, 
and health care information about the individual. 

89. For the present purpose, however, we cite only those specifics that are applicable to this 
case: 

(a) the individual's name 
(...) 

(i) information about the individual's education... 4 

90. The personal information at the heart of this case included the student's information as it 
concerned the student's education, specifically, the name of the student, the school, the 
issue as to whether the student would write the Assessment (a graduation requirement), 
the fact that the student eventually wrote and successfully completed the Assessment, 
and the test results attributed to the student. 

91. All this information belonged to and identified the student and therefore this case falls 
squarely within the ambit of the Act as it relates to the student's personal information 
and its handling by public bodies, i.e., the Department and the Minister's Office. 

Rules that protect personal information 

92. It is under Part 3 of the Act, entitled "Protection of Privacy," that we find all the rules that 
govern the handling of personal information by public bodies, including its collection, use 
and disclosure. 



4 See section 1. 
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93. The main rule that we refer to as the guiding principle restricts the handling of personal 
information to the minimum necessary: 

Collect, use or disclose only the minimum amount of personal 
information reasonably necessary to accomplish the purpose 
for which the information is first solicited. 5 

94. This concept is fairly simple in its description, but not always easy to apply. 

95. The guiding rule obligates employees of a public body to collect and use only the 
personal information that they need to carry out their work. For example, to obtain a 
public library card, an individual needs to provide proof of identification such as a driver's 
license which library staff are required to collect in order to verify the individual's 
identity and contact information; however, staff do not need and must not collect 
additional personal information such as proof of income simply to carry out the task of 
providing the library card. This illustrates the connection between personal information 
and how much of it is needed in order to carry out a task. 

96. At collection, the public body must inform the individual why his or her personal 
information is being collected. This discussion allows both the public body and the 
individual to know exactly how much personal information is required, how it will be 
used, and equally important, with whom it can be shared (i.e., its collection, use and 
disclosure). This falls in well with the limits that are placed on the use and sharing of 
personal information to only those who need it to perform their tasks; tasks for which 
the information was first collected. This is often referred to as the "need to know" rule. 6 

97. These rules are in a nutshell those within which all public bodies must operate whenever 
handling personal information. The rules also establish how and when personal 
information can be lawfully shared by recognizing that public bodies need to share or 
disclose personal information in order to administer programs and provide services to 
citizens essential to good governance. 

98. Having established what constitutes the student's personal information at the centre of 
this case and the rules governing its handling, the question now becomes did either the 
Department or the Minister's Office commit a breach of privacy? 



5 See subsections 37(2) and 43(2). 

6 See subsection 43(3). 
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Was there a privacy breach in this case? 

99. The evidence we uncovered demonstrated that there was more than one incident of 
privacy breach involving the student's personal information in this case. 

100. We found that both the Department and the Minister's Office caused privacy breaches 
but only in relation to disclosure of personal information, not in relation to its collection 
or use. We address each of these points in turn. 

Collection and Use by the Department 

101. The facts of this case show that the Department was authorized to collect and use the 
student's personal information so that the student could write the Assessment. This 
finding is based on the Department's lawful authority to collect and use personal 
information to carry out a task under the Education Act, specifically, to administer the 
Assessment for public high school students in the Anglophone sector. 

102. In various telephone conversations, meetings and email messages between the 
Department's staff and the family, the Department collected and used the student's 
personal information and only the amount necessary to: 

a) first determine whether the student would be required to write the 
Assessment given the fact that the family moved to New Brunswick from 
outside Canada; 

b) set up a time and place for the student to write the Assessment and to 
ensure that appropriate accommodations were made for the student; and, 

c) score the Assessment to arrive at test results for the student. 

103. Having reviewed the Department's practices and procedures in relation to these matters, 
we find that the Department appropriately handled the student's personal information 
for the purpose of administering the Assessment. 

Collection and Use by the Minister's Office 

104. The facts of this case are equally clear that the Minister's Office was authorized to collect 
and use the student's personal information so that a determination be made in relation 
to whether the student was required to write the Assessment, or that the student be 
granted an exemption or waiver. This finding is based on the fact that the family sought 
the assistance of the Minister's Office in this regard and provided consent accordingly. 
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105. In the meeting held with the family and email messages exchanged, the Minister's Office 
collected and used the student's personal information only to determine whether the 
student qualified for an exemption under the Policy 316 not to write the Assessment 
given the fact that the family moved to New Brunswick from another English-speaking 
foreign jurisdiction, and failing that, to provide accommodations for the student in the 
circumstances so as not to write at the same time as the Grade 12 exams. 

106. Having reviewed the actions of the Minister's Office in relation to the family's request for 
help, we find that the Minister's Office appropriately handled the student's personal 
information for this purpose. 

Disclosure by the Minister's Office - Part 1 

107. As the family sought help directly from the Minister, the information collected was 
shared with two senior staff members of the Department in order for them to advise the 
Minister on how best to provide an answer to the family's request. 

108. We found no evidence of wrongdoing when the Minister's Office communicated the 
student's personal information to these two senior staff members in order to seek their 
assistance in finding answers to the family's concerns. This would be the normal course 
of action and is standard practice across Provincial government departments. 
Furthermore, the Minister's Office had the family's consent to use and disclose the 
information in this manner. 

109. For our present purposes, it must be noted that these two senior staff members were 
the same officials to whom the student's personal information was later communicated 
by Department staff after the student wrote the Assessment in April 2013. This fact 
becomes important as we describe further in this Report why the privacy breaches 
occurred in this case. 

110. Notwithstanding, in the context of the family's concern for the student having to write 
the Assessment in order to graduate, in seeking the Minister's direct assistance, the 
family gave his Office consent and therefore the authority to act on that concern and 
share the request with senior staff. This included the need to share the student's 
personal information with staff in order to conduct the appropriate follow-up and report 
back directly to the family. 
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Disclosures by the Department 

111. For the most part, the facts showed that the Department disclosed the student's 
personal information again in accordance with its usual confidential and proper practice 
for administering the Assessment. 

112. Also, the Department lawfully disclosed the fact that the student had written and 
successfully completed both components of the Assessment and test results attributed 
to the student when the Department processed and issued this information to the 
appropriate officials, namely when the Department communicated this information to 
the Superintendent of the District and to the Principal of the high school where the 
student attended. 

113. On the other hand, the facts also demonstrate that the Department deviated from its 
usual practice when it handled the student's personal information. In the context of all 
the circumstances surrounding the family's requests for assistance not only to the 
Department, but also the Minister, the media and other politicians, which the family was 
more than entitled to do, the Department handled the student's personal information 
differently than it normally did as this was an unusual case. 

114. A Department staff member reviewed the list of test results on which the student's 
results were also listed, a task that the staff member was authorized to do, but with a 
view to determine two important points relevant to this case: 

• whether the student had in fact written the Assessment; and, 

• whether the student had passed it. 

115. The staff member wanted to know these particular facts in order to properly advise the 
two senior staff members given the concerns expressed by the family directly to the 
Minister in October of 2012. In other words, the staff member wanted to report back to 
senior staff that the student had written the test and passed so that there was no 
lingering issue in relation to this graduation requirement for the student in question. 

116. The high profile of this particular case was such that to advise these senior staff members 
of the student having written and passed the Assessment was done not with a view to 
breach the student's privacy but for the single purpose of advising of the fact that the 
family's concerns surrounding the Assessment had been resolved. 

117. This is why the staff member shared that information with two other senior staff 
members who would not normally be privy to this information. The student's 
information was handled in a different fashion due to all of the circumstances 
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surrounding this case and the need to keep senior staff abreast of the developments 
given the public nature to this case. 

118. The staff member sent an email to two members of the Department's senior staff 
advising that the scores were finalized and that the student was successful on both 
components. The email also went further to include the student's scores for each 
component of the Assessment. 

119. We find that informing senior staff that the student had written the Assessment and had 
passed it was an appropriate disclosure of the student's personal information given all of 
the circumstances of this case. In our view, it was the act of communicating the test 
results that constituted an inappropriate disclosure of the student's personal information 
in this matter. The test results had nothing to do with informing senior staff that the 
family's situation had been resolved, i.e., the email disclosed more than the minimum 
amount of information necessary to carry out that task. The disclosure of the student's 
test results to senior staff members constituted a breach of privacy. 

120. Then, we found that another privacy breach took place. One of the senior staff members 
who received the email containing the student's information described above in turn 
forwarded the same email to the Minister's Executive Assistant for the same purpose, to 
inform the Minister that the situation had been resolved. The facts are clear that the 
Minister did not receive this email. 

121. For the same reasons as indicated above, we find that the facts of this case were such 
that it was appropriate to inform the Minister's Office that the family's concerns 
surrounding the student having to write the Assessment were fully resolved. Where we 
find there was a breach was in the Department's senior staff having sent the same email 
that contained the student's test results to the Executive Assistant. Senior staff ought 
not to have shared the test results as the Executive Assistant was not a person lawfully 
authorized under the Act to know this personal information only to inform the Minister's 
Office that the student had written and successfully passed the Assessment. 

122. Again, the test results had nothing to do with informing the Minister's Office that the 
family's situation had been resolved. The first email that caused a breach contained too 
much personal information and the second breach was caused when it was forwarded to 
the Executive Assistant. The email to the Executive Assistant disclosed more than the 
minimum amount of information necessary to carry out the task of simply informing the 
Minister's Office. 
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Disclosure by the Minister's Office - Part 2 

123. As indicated above, the Minister's Executive Assistant was the recipient of the 
Department's email in which the student's test results were wrongfully disclosed. 

124. The Executive Assistant acted inappropriately in relation to the email and in doing so 
committed yet another privacy breach. 

125. The imprudent actions of the Minister's Executive Assistant consisted of first reading the 
email aloud and secondly, doing so while at home unaware there was another family 
member present within hearing distance. This amounted to a lack of proper care and 
attention when reading work-related emails, especially outside of confines of a more 
secure workplace, and amounted to an improper handling of the student's personal 
information. 

126. Regrettably, and as was widely reported in the news, the family member who overheard 
the Executive Assistant sent a congratulatory text message to the student who had not 
yet received the results through the usual channels. Finding out of the student's test 
scores in this manner understandably caused the family significant grief and concern. 

Why did it happen? 

127. Our investigation revealed that the reasons why this information was shared in this 
manner were based on an overarching concern to see a successful outcome for the 
student involved, or in other words, that the requirement of writing the Assessment not 
become an obstacle to the student graduating from high school. 

128. Everyone at the Minister's Office and Department that we interviewed stated that they 
were genuine in attempting to find a solution to the family's concerns and a solution that 
remained respectful of Policy 316 and the student's best interests. The aim was to 
ensure the student be given every opportunity to meet this graduation requirement. 

129. In addition, Department staff was preoccupied with what was by all accounts an unusual 
case surrounding the administration of the Assessment. The Department had the best 
intentions in the face of constant media attention and political pressure to find a solution 
to the family's concerns. 

130. It is in this context that the Department staff believed senior staff as well as the 
Minister's Office needed to know this information. While all involved acknowledged that 
it was highly unusual to share a particular student's situation in this manner, the purpose 
for communicating this information was to let senior staff and the Minister's Office know 
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that the situation had a positive and successful outcome. It is for all these reasons that 
the Department's improper disclosures took place. 

131. We appreciate the reasons why and accept that Department staff made the decision to 
share the outcome of the situation with senior staff and the Minister's Office. We find, 
however, that despite these valid reasons, communicating too much personal 
information (the student's test results) was contrary to the Act. The Department was not 
permitted to deviate from its established protocols in relation to communicating the 
student's test results. We find that doing so was the root cause of the privacy breaches 
which took place. 

132. As for the Minister's Office, the Executive Assistant who was also present when the 
family first asked to seek the Minister's help was equally relieved to see the matter come 
to a satisfactory resolution. The email in question was a positive resolution to a situation 
that had persisted for seven months. The Executive Assistant was pleased with this 
outcome; perhaps that is why the Executive Assistant read aloud the email at home, 
forgetting for the moment that this was not wise. 

133. As a final point, we express our own concerns about protocols for sharing personal 
information when a Minister, also a Member of the Legislative Assembly and 
representative of constituents, asks staff for advice or assistance in order to provide 
answers to concerns expressed directly to him. 

134. We can appreciate that the lines were blurred in relation to certain aspects of this case— 
the Minister was acting in both his capacity as a Member of the Legislative Assembly and 
the head of the Department, the Minister's constituency assistant later became his 
Executive Assistant, plus the media and political involvement that raised the public 
profile of the situation. This led to some confusion about what personal information 
could be shared with whom and for what purposes. 

135. While the Department deviated from its usual practice to communicate test results, we 
did not find any evidence of ill will or malicious intent on behalf of any of the officials 
involved in this case. To the contrary, the evidence demonstrates that everyone involved 
was primarily concerned with the student's best interests while perhaps becoming too 
involved in providing assistance in the process. 
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What steps have been taken to address the breach? 

136. The Minister became aware of the situation on May 8, 2013 when the Executive 
Assistant informed him about what had happened. The Minister then appointed a senior 
official who was not involved with the case to look into the situation to determine what 
had occurred and the extent of the breach. The senior official confirmed to whom the 
email containing the student's test results had been sent. The student's personal 
information disclosed without authorization could not be retrieved in this case as it had 
already been shared with those who were not authorized to know it. 

137. The Minister personally took steps to prevent any further breaches of the student's 
personal information once he learned of the situation. The Minister faced many 
questions from other Members of the Legislative Assembly over the following weeks 
asking for more details about the situation, but the Minister consistently and rightly in 
our view refused to publicly discuss any details of the family's case. 

Corrective measures to date 

138. The Department and the Minister's Office are now more aware of the importance of 
maintaining solid privacy practices even in unusual or difficult circumstances. Upon 
learning of the breach in this case, both the Department and the Minister recognized the 
need to improve their internal policies and procedures. 

139. The Department has confirmed that it has made arrangements for staff to receive 
comprehensive training on the privacy obligations and requirements under the Act to 
reduce the risk of future privacy breaches. The Department has also indicated its 
interest in receiving the Commissioner's recommendations in that regard. 

FINDINGS 

140. In accordance with all of the above, we make the following findings. 
Collection and Use by the Department - No breach 

141. We find that the facts of this case show that the Department was lawfully authorized to 
collect and use the student's personal information based on its need to carry out a task 
under the Education Act, specifically, to administer the Assessment for public high school 
students in the Anglophone sector. 

142. The facts demonstrate that the Department appropriately handled the student's 
personal information for the purpose of administering the Assessment. 
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Collection and Use by the Minister's Office - No breach 

143. The facts of this case are equally clear that the Minister's Office was authorized to collect 
and use the student's personal information so that a determination be made in relation 
to whether the student was required to write the Assessment, or that the student be 
granted an exemption or waiver. This finding is based on the fact that the family sought 
the assistance of the Minister's Office in this regard and provided consent accordingly. 

144. Having reviewed the actions of the Minister's Office in relation to the family's request for 
help, we find that the Minister's Office appropriately handled the student's personal 
information for this purpose. 

Disclosure by the Minister's Office - Part 1-No breach 

145. As the family sought help directly from the Minister, the information collected was 
shared with two senior staff members of the Department in order for them to advise the 
Minister on how best to provide an answer to the family's request. We found no 
evidence of wrongdoing when the Minister's Office communicated the student's 
personal information to these two senior staff members in order to seek their assistance 
in finding answers to the family's concerns. This would be the normal course of action 
and is standard practice across Provincial government departments. Furthermore, the 
Minister's Office had the family's consent to use and disclose the information in this 
manner. 

Disclosures by the Department - Two breaches of privacy 

146. We find that informing senior staff that the student had written the Assessment and had 
passed it was an appropriate disclosure of the student's personal information given all of 
the circumstances of this case. In our view, however, it was the act of communicating 
the test results that constituted an inappropriate disclosure of the student's personal 
information in this matter. The test results had nothing to do with informing senior staff 
that the family's situation had been resolved, i.e., the email disclosed more than the 
minimum amount of information necessary to carry out that task. The disclosure of the 
student's test results to senior staff members constituted a breach of privacy. 

147. It was also appropriate to inform the Minister's Office that the family's concerns 
surrounding the student having to write the Assessment was fully resolved but for the 
same reasons, the Department's senior staff committed a breach when sending the same 
email that contained the student's test results to the Executive Assistant, thereby sharing 
more personal information than was necessary. The test results had nothing to do with 
informing the Minister's Office that the family's situation had been resolved. 



25 | P a g e 



Office of Access to Information and Protection of Privacy Commissioner of New Brunswick - Breach Notification Matter 2013-1368-AP-702 and 
Privacy Concern Matter 2013-1370-AP-704 REPORT OF THE COMMISSIONER'S FINDINGS - August 19, 2013 

Disclosure by the Minister's Office - Part 2 - One breach of privacy 

148. The Minister's Executive Assistant received the Department's email that contained too 
much personal information in the form of the student's test results. The Executive 
Assistant acted inappropriately in relation to the email by reading the email aloud and 
doing so while at home unaware there was another family member present. This 
amounted to an improper handling of the student's personal information and 
constituted a breach of privacy. 

Family's privacy concerns filed with our Office 

149. Accordingly, the family's privacy concern against the Department is founded, as the 
student's test results were viewed by a Department staff member, who then shared the 
student's personal information outside of the usual process for sharing student test 
results. 

150. The family's privacy concern against the Minister's Office is founded, as the Minister's 
Executive Assistant should not have read the email containing the student's personal 
information aloud so as to disclose it to family member. 

151. The family's privacy concern against the Minister is unfounded. While the Minister was 
informed of the student's test results as a result of the unauthorized disclosure, the 
Minister was not involved in the circumstances that lead to the breach. In addition, after 
the Minister publicly acknowledged that a privacy breach had occurred, the Minister took 
steps to ensure that he did not discuss the situation publicly so as to prevent any further 
breaches of the student's personal information. 

CONCLUDING COMMENTS 

152. This case has demonstrated how easy it is for staff members who are otherwise well- 
experienced in the protection of personal and confidential information to nevertheless 
deviate from their usual good practices when faced with unusual or extraordinary 
circumstances. While it may be believed that as long as personal information stays within 
the confines of an office it will not constitute a privacy breach, we know that this belief is 
based on a lack of awareness of privacy rules under the Act. 

153. As we observed in this case, officials from the Department were not at liberty to share all 
of the student's personal information with other staff members without a legitimate 
purpose to do so. 
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154. The rule is simple: only use and disclose the minimum amount of personal information 
that is necessary to accomplish the task and only to share this information with those 
who need to know. 

155. This rule becomes more crucial when using technology intended to improve our work 
lives by allowing an expedient transmission of the information to those with whom we 
work as it can also cause the user of the technology to quickly make a serious error when 
not taking the time to apply the rule correctly. 

156. In this case, one email containing too much personal information was transmitted in 
succession to other users thereby causing multiple breaches of privacy as no one 
recognized that it contained too much information. 

157. Undeniably, this was a very difficult situation for all involved. The family and the student 
at the heart of the matter for obvious reasons felt their privacy had been violated. The 
Executive Assistant who read email aloud and family members were also impacted and 
upset that grief had been caused to someone they knew. The fact that this case was so 
high profile with media and political involvement made it more difficult as actions were 
publicly scrutinized. 

158. The Minister and Department staff were also troubled and felt genuinely sorry that the 
Department and his Office had breached the privacy of the student when there was no 
intent to do so or cause harm. The fact that the personal information unlawfully 
disclosed was positive, i.e., the test results indicating that the student was successful in 
passing the Assessment, did not in any way diminish the privacy breaches or harm 
caused by them. 

159. The consequences of these actions have resulted in the family's lack of confidence in 
how Department and Minister's Office handles confidential student information, and 
perhaps, the public's. 

160. We do add for the record that during the course of this investigation, the Minister issued 
a letter of apology to the family. While an apology could not correct the harm done, we 
believe it was a good faith effort to admit to the wrong committed and to start rebuilding 
the trust that the Minister and his Department lost as a result of these breaches. 

161. The family was correct in bringing this privacy concern to our attention. Today, the 
Department will be asking itself the right questions about how to make improvements in 
its procedures in order to prevent future incidents as that we found took place in this 
case. 
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162. In conclusion, we take this opportunity to share three simple tips that everyone can use 
whenever having to communicate private or confidential information: 

• THINK before you speak, 

• CONSIDER before you write, and, 

• PAUSE before you click. 

163. It has been our experience to date that by adopting these simple measures, one can 
reduce the risk of inadvertently mishandling the information. 

RECOMMENDATIONS 

164. Given the findings above, the Commissioner makes the following recommendations 
under paragraph 60(l)(h) of the Act: 

• That the Department review its internal practices; 

• That the Department establish without delay a review of its internal procedures 
in relation to all the personal information that comes into its custody and control 
and that it uses and discloses in the performance of its functions and duties with 
a view to ensure that these procedures obligate staff to protect privacy at all 
times and in accordance with the rules regarding the collection, use and 
disclosure of personal information set out in Part 3 of the Act; 

• That the Department report to the Office of the Commissioner in regards to its 
progress in this review no later than February 28, 2014; 

• That the Minister's Office review its internal practices with a view to ensure that 
these practices allow its staff to protect personal information collected when a 
member of the public approaches the Office for assistance, with a view to ensure 
the use and disclosure of such personal information is done in accordance with 
the Act; and, 

• That the Minister's Office report to the Office of the Commissioner in regards to 
its progress in this review no later than December 13, 2013. 



28 | P a g e 



Office of Access to Information and Protection of Privacy Commissioner of New Brunswick - Breach Notification Matter 2013-1368-AP-702 and 
Privacy Concern Matter 2013-1370-AP-704 REPORT OF THE COMMISSIONER'S FINDINGS - August 19, 2013 



165. The Commissioner also makes the following recommendations to the Department under 
paragraph 60(l)(h) of the Act: 

• That the Department follow the established practice for reporting students' 
English Language Proficiency Assessment results in all cases and without 
exception to adequately protect the students' personal information. 



Dated at Fredericton, New Brunswick, this day of August, 2013. 



Anne E. Bertrand, Q.C. 
Commissioner 
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